---
title: "POST /oauth/authorize/consent"
method: POST
path: "/oauth/authorize/consent"
tags: ["oauth"]
---

# POST /oauth/authorize/consent

`POST /oauth/authorize/consent`

## Request

- Base URL: `https://api.pricklymails.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.pricklymails.com/oauth/authorize/consent`
- Auth: HTTP bearer

## Request body

- ConsentRequest: `POST /oauth/authorize/consent` request body.
  - `agent_uuid` string, required: Public UUID of the caller's own agent to authorize.
  - `approve` boolean, required: Whether the user approved the request.
  - `client_id` string, required: The client's public `client_id`.
  - `code_challenge` string, required: PKCE `code_challenge` (RFC 7636).
  - `code_challenge_method` string, required: PKCE `code_challenge_method`; only `"S256"` is supported.
  - `redirect_uri` string, required: The redirect target, which must exactly match one of the client's registered URIs.
  - `state` string, nullable: Opaque anti-CSRF value, echoed back unchanged.

## Response `200`

Redirect URL for the frontend to navigate the browser to.

- ConsentResponse: `POST /oauth/authorize/consent` response body.
  - `redirect_url` string, required: Where to navigate the browser next: the client's own `redirect_uri` carrying either `code` and `state` (approved) or `error=access_denied` and `state` (denied).

## Other responses

- `400`: Unknown client, redirect_uri mismatch, or invalid PKCE parameters.
- `401`: Missing or invalid JWT.
- `403`: The caller is an admin impersonation session.
- `404`: No agent with that UUID owned by the caller.

---

[API](https://skmtc.dev/pricklymails/apis/pricklymails-api.md) · [All operations](https://skmtc.dev/pricklymails/apis/pricklymails-api/llms.txt) · [OpenAPI document](https://skmtc.dev/pricklymails/apis/pricklymails-api/revisions/b4225a92d8fb?raw)